GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.13] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree` when possible (GH-149023) by StanFromIreland · Pull Request #151160 · python/cpython

Conversation

@StanFromIreland

@StanFromIreland StanFromIreland commented Jun 9, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

(cherry picked from commit 24b8f12)

  • Issue: [CVE-2026-7210] Insufficient entropy in pyexpat with protection against hash flooding #149018

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@StanFromIreland
[3.13] pythongh-149018: Use XML_SetHashSalt16Bytes in pyexpat/`_e…
47c9d32 
…lementtree` when possible (pythonGH-149023)

(cherry picked from commit eeea765)

Co-authored-by: Stan Ulbrych <[email protected]>
(cherry picked from commit 24b8f12)
@StanFromIreland
StanFromIreland requested review from gpshead and tiran as code owners June 9, 2026 14:25
@bedevere-app bedevere-app Bot added the awaiting core review label Jun 9, 2026
This was referenced Jun 9, 2026
[CVE-2026-7210] Insufficient entropy in pyexpat with protection against hash flooding #149018
Closed
gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible #149023
Merged
@StanFromIreland

StanFromIreland commented Jun 9, 2026

Copy link
Copy Markdown
Member Author

This actually backported cleanly, so I'm merging.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@StanFromIreland
StanFromIreland enabled auto-merge (squash) June 9, 2026 14:25
@read-the-docs-community

read-the-docs-community Bot commented Jun 9, 2026

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #33059682 | 📁 Comparing 47c9d32 against main (0a179e7)

  🔍 Preview build  

456 files changed · ± 417 modified · - 39 deleted

± Modified

  • about.html
  • bugs.html
  • copyright.html
  • glossary.html
  • index.html
  • license.html
  • py-modindex.html
  • c-api/allocation.html
  • c-api/apiabiversion.html
  • c-api/arg.html
  • and 407 more...

- Deleted

  • improve-page-nojs.html
  • improve-page.html
  • _static/tachyon-example-flamegraph.html
  • _static/tachyon-example-heatmap.html
  • c-api/extension-modules.html
  • c-api/interp-lifecycle.html
  • c-api/lifecycle.html
  • c-api/profiling.html
  • c-api/sentinel.html
  • c-api/slots.html
  • and 29 more...
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@StanFromIreland
StanFromIreland merged commit fc9b11f into python:3.13 Jun 9, 2026
43 of 46 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting core review label Jun 9, 2026
@StanFromIreland
StanFromIreland deleted the backport-eeea765-3.13 branch June 12, 2026 13:03
@StanFromIreland StanFromIreland added the needs backport to 3.12 only security fixes label Aug 7, 2026
@miss-islington-app

miss-islington-app Bot commented Aug 7, 2026

Copy link
Copy Markdown

Thanks @StanFromIreland for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Aug 7, 2026

Copy link
Copy Markdown

Sorry, @StanFromIreland, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker fc9b11ff49cbc82e6f917d07a61517a2b5f3145f 3.12
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app miss-islington-app Bot assigned StanFromIreland Aug 7, 2026
@StanFromIreland StanFromIreland removed the needs backport to 3.12 only security fixes label Aug 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead Awaiting requested review from gpshead gpshead is a code owner
@tiran tiran Awaiting requested review from tiran

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@StanFromIreland StanFromIreland

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

1 participant

@StanFromIreland
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.